Live data from Hacker News

Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

hsmr.cc

41–47 of 47 posts

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#41
post #12

Earlier quoted context omitted.

This was a problem with WebGL a few years ago on some OS/GPU/Browser combinations. It was possible to write a WebGL app that created uninitialized textures, drew them on screen, grabbed a screenshot and then uploaded that via HTTP(s) to a server. This issue should now be fixed, but bugs and/or old unpatched browsers may still be out there.

That browsers have bugs that might leak info is not special to WebGL or GPUs. The bugs are found, they get fixed.

Oh sure, but in this particular case it seemed like no-one had thought about the issue that uninitialized textures can be used for snooping screen content, this wasn't mandated by the spec (IIRC).

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#42
post #36

Something similar happened to me, but with a different scenario. I hibernated my Arch Linux system and then booted into Windows (I unmount all of my NTFS partitions beforehand), did some work, and then rebooted into Linux again. The GNOME lock screen doesn't play nice with my NVIDIA drivers (closed-source), so it doesn't reinitialize the lock screen texture when it wakes up from suspend-to-RAM or suspend-to-disk. The…

I've seen worse. An old Dell laptop, which originally came with Windows, repurposed as a Linux laptop. It had been used exclusively as a Linux laptop (the Windows partitions had been overwritten by the Linux install) for several months if not years, when one day, its lock screen displayed a Windows desktop (I don't recall if the laptop had just returned from suspend or not). Moving the mouse dispelled the "ghost" scr…

These stories, and the hdd full fledge arm controllers[1] makes me thing we need to correctly map and manage every bit of memory and processing unit in our machines.

[1]http://hackaday.com/2013/08/02/sprite_tm-ohm2013-talk-hackin...

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#43
post #36

Something similar happened to me, but with a different scenario. I hibernated my Arch Linux system and then booted into Windows (I unmount all of my NTFS partitions beforehand), did some work, and then rebooted into Linux again. The GNOME lock screen doesn't play nice with my NVIDIA drivers (closed-source), so it doesn't reinitialize the lock screen texture when it wakes up from suspend-to-RAM or suspend-to-disk. The…

I've seen worse. An old Dell laptop, which originally came with Windows, repurposed as a Linux laptop. It had been used exclusively as a Linux laptop (the Windows partitions had been overwritten by the Linux install) for several months if not years, when one day, its lock screen displayed a Windows desktop (I don't recall if the laptop had just returned from suspend or not). Moving the mouse dispelled the "ghost" scr…

Just to clarify ... the laptop you describe was powered off daily? Even Once? Powered off?

Then what you saw was NOT a VRAM artifact. Aside from OP clearly stating it is a re-boot issue, powering off the laptop would have removed power to the video RAM chips -- thus they would have lost their stored data.

What is likely you saw was a screen saver program displaying a random image which it found on the laptop hard drive. How this came to be found (assuming it is what you saw, just to give you the benefit of the doubt) would be very hard to guess without the laptop and it's configuration.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#44
post #23

A few thoughts ... First, tails scrubs memory (or something like that) when you shut down - should they be scrubbing vram as well ? Second, wouldn't it be quick and simple to "scrub" vram by filling it up with intensive usage after working on sensitive information ? What happens if I watch 2 minutes of 1080p video - wouldn't we expect all previous framebuffer data to be flushed at that point ? Finally, I would be ver…

the original post shows Tails leaking info.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#45
post #36

Earlier quoted context omitted.

I've seen worse. An old Dell laptop, which originally came with Windows, repurposed as a Linux laptop. It had been used exclusively as a Linux laptop (the Windows partitions had been overwritten by the Linux install) for several months if not years, when one day, its lock screen displayed a Windows desktop (I don't recall if the laptop had just returned from suspend or not). Moving the mouse dispelled the "ghost" scr…

Just to clarify ... the laptop you describe was powered off daily? Even Once? Powered off? Then what you saw was NOT a VRAM artifact. Aside from OP clearly stating it is a re-boot issue, powering off the laptop would have removed power to the video RAM chips -- thus they would have lost their stored data. What is likely you saw was a screen saver program displaying a random image which it found on the laptop hard dri…

That was a long time ago, so my memory is a bit hazy on the details. If I recall it correctly, it was the laptop I was using at the time, and I almost always powered it off when leaving work. I still have another laptop of the same set at work, so I could look up the exact model tomorrow if you want (it's an old Dell Latitude IIRC).

But I can clearly recall that I thought at the time precisely that: "how is that even possible, powering off the laptop should have cleared the video memory, and this laptop didn't have a Windows install for years!" Yet, there it was, a Windows desktop with one window (or dialog, can't recall precisely) open. (I don't recall how I knew it was from its old Windows install; it might have been showing some work-related information.)

It wasn't the screen saver; IIRC, I used the "blank screen" screensaver (or some other equally simple screensaver), not a "slideshow" or "random" screensaver.

Yeah, it's hard to believe. I myself would have found it hard to believe if I hadn't seen it. I even took a photo, but it was several mobile phones ago, so I'd have to search through my old backups to see if I can find it.

The only explanation I could come up with was that the video memory on that laptop for some reason retained its contents as long as the laptop battery wasn't removed (while the laptop had been powered off many times, its battery had not been removed), and the Windows driver used the video memory in a different way than the Linux driver, so that desktop snapshot never got overwritten. Then one day a glitch made the "read the screen contents from here" pointer point to it, and so it showed in the screen. It's ridiculously unlikely, but I couldn't come up with a better explanation; it's even more bizarre in that the "ghost" image was perfect, with no visual glitches.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#46
post #35

Earlier quoted context omitted.

In these tests we were able to recover screenshot-like views of entire websites after viewing them in the newest version of chromium, then running the poc on the local system.

Chrome isn't trying to not let other (non-chrome) processes read info. It's trying not to let other chrome processes (other webpages, native client, etc) not read info. In other words, stuff running inside Chrome can't read stuff it's not supposed to be able to since nearly all that code is untrusted.

Chrome saves its VRAM when using WebGL, but it does not protect the hardware accelerated website rendering. thats why one could read out VRAM with chrome content as well.

Re: Is Your VirtualBox Reading Your E-Mail? Reconstruction of FrameBuffers from VRAM

#47
post #34

Earlier quoted context omitted.

shutdown clears, reboot doesnt.

Shutdown actually doesn't clear RAM, hence the "cold boot attack" terminology. Eventually the data will degrade, but eventually can be a long time.

Yeah. My comment was ment to answer the question above yours...
Post reply on HN